Skill UI

This guide details the exploitation of the Active Directory Certificate Services (AD CS) ESC1 vulnerability. By leveraging misconfigurations, an attacker can request certificates impersonating high-privileged users (e.g., Domain Admins). The workflow covers AD enumeration, forging certificates with arbitrary Subject Alternative Names (SANs), authenticating via PKINIT, and ultimately escalating domain privileges using tools like mimikatz. Essential for authorized red team and penetration testing.

This technique abuses the Active Directory's `msDS-KeyCredentialLink` attribute to inject attacker-controlled public keys (Shadow Credentials). After gaining write access (e.g., via BloodHound), the attacker uses tools like pyWhisker or Certipy to append their key. They then authenticate via PKINIT to recover the target's NT hash, achieving complete account takeover without the disruptive step of a password reset. Ideal for stealthy red-teaming engagements.

A comprehensive red-teaming technique for Active Directory Certificate Services (AD CS). This skill utilizes the Certipy toolkit to enumerate and exploit various Certificate Service Configuration (ESC1-ESC16) misconfigurations over LDAP/RPC. It enables attackers to forge privileged certificates and perform PKINIT authentication, escalating a low-level domain foothold to Domain Admin or Domain Controller access during authorized penetration tests.

This technique exploits vulnerable Active Directory Certificate Services (AD CS) HTTP web-enrollment endpoints (ESC8) that lack Extended Protection for Authentication (EPA). By coercing a Domain Controller (DC) to authenticate and relaying the captured NTLM credentials, an attacker can obtain a DC machine certificate. This certificate is then used via PKINIT to request a TGT, recover the DC's NT hash, and ultimately achieve full domain compromise via DCSync. Essential for advanced AD red-teaming simulations.

This specialized skill guides users through analyzing complex Active Directory Certificate Services (AD CS) abuse scenarios. It is essential for proving how a weakness in a template, CA policy, or issuance right can lead to unauthorized privilege acceptance (e.g., via PKINIT, Schannel). The workflow focuses on mapping the entire certificate issuance chain to the resulting accepted service path.